Getting "Access to the resource is forbidden" error when creating report "GET_FBA_FULFILLMENT_CUSTOMER_SHIPMENT_SALES_DATA"

[nonfatalexec]

I'm getting this exception
sp_api.base.exceptions.SellingApiForbiddenException: [{'code': 'Unauthorized', 'message': 'Access to the resource is forbidden', 'details': ''}]
when trying to create the report "GET_FBA_FULFILLMENT_CUSTOMER_SHIPMENT_SALES_DATA".

Here is the code snippet:
report_request = reports_api.create_report(reportType="GET_FBA_FULFILLMENT_CUSTOMER_SHIPMENT_SALES_DATA", dateStartTime=str(date.today() + dt.timedelta(days=-days_ago))+"T04:00:00", dateEndTime=str(date.today())+"T04:00:00")
A similar code has no issues:
report_request = reports_api.create_report(reportType="GET_FLAT_FILE_OPEN_LISTINGS_DATA", dateStartTime=str(date.today())+"T04:00:00", dateEndTime=str(date.today())+"T04:00:00")

I have these roles in my app:

Finance & Accounting
Selling Partner Insights
Buyer Communication
Pricing
Inventory and Order Management
Brand Analytics
Amazon Fulfilment
Buyer Solicitation
Product Listing

How should I debug this?

[saleweaver]

Maybe PII? I don't know the report, but having a ship to location indicates PII data

[nonfatalexec]

The report has these fields: 'shipment-date', 'sku', 'fnsku', 'asin', 'fulfillment-center-id', 'quantity', 'amazon-order-id', 'currency', 'item-price-per-unit', 'shipping-price', 'gift-wrap-price', 'ship-city', 'ship-state', 'ship-postal-code'
I was previously using MWS and I pulled this list from that code. Would this still require restricted data tokens?

[nonfatalexec]

I resolved this. I think the issue was I added the "Amazon Fulfilment" role, but didn't get a new refresh token. I created a new refresh token and it started working about 30 minutes later.